A large, for-profit government contractor based in the eastern corridor of Washington, D.C. provides business services to government agencies in the US and other countries. Employing more than 15,000 professionals, the organization administers programs of all sizes,  from enormous federal programs to smaller state and local programs that directly assist a broad sector of the population. Biggest Challenge of Adopting the Cloud isn’t Technical Increasingly the organization’s clients had begun asking about the possibility of receiving cloud-based services because of lower TCO. Internally, the company also realized that it could reap significant benefits from providing services using the public cloud. Like its customers, the organization could take advantage of reduced TCO. Using the public cloud, it could also quickly ramp up or scale down the number of users—a huge benefit for a company with so many contracted projects. Clearly, the cloud belonged in the government contractor’s future, so the system analyst and his colleagues set out to figure out how best to secure it. In the process, they discovered that, as he puts it: “The biggest challenge of the public cloud isn’t technical.” Rather, it is overcoming the perception that the cloud can’t be secured. “We have had to educate both internally and externally that we can extend our existing threat defenses beyond our physical infrastructure to the public cloud,” says the system analyst. “Education is ongoing, but our success thus far at securely leveraging the public cloud is converting the naysayers.” Easy Deployment of Cloud Protection for AWS After carefully researching cloud security options, the company decided to implement McAfee Cloud Workload Security before launching its first contracted project using Amazon Web Services (AWS). They already relied on the McAfee integrated security platform and a variety of McAfee solutions to secure its physical and virtual infrastructure of 35,000 endpoints (including servers). These products are all managed using the McAfee ePO central console—as is McAfee Cloud Workload Security.
“Adding the public cloud to our McAfee infrastructure was simple,” notes the system analyst. “We spun out the cloud side in less than a week. With McAfee ePO software, it was easy to implement McAfee Cloud Workload Security and set security policies for the project.” As part of the McAfee Cloud Workload Security solution, they deployed the Data Center Connector for AWS, Cloud Usage Metering, Data Protection for Cloud, Data Center Visualization, and Data Center Assessment components. With this functionality, the organization has end-to-end visibility into all cloud workloads and their underlying platforms and insights into weak security controls, unsafe firewall and encryption settings, and indicators of compromise (IoCs). In addition, the same McAfee Endpoint Security, which protects its physical and virtual endpoints, protects the company’s endpoints within the AWS cloud. Flexibility and Bandwidth to Accommodate Volatility in Server Volume The company’s first AWS-based project serves a handful of US federal government agencies with a combined total of 1,500 endpoints. As part of the project, the company created a web-based portal where authorized users from these agencies can review aspects of their program’s infrastructure, request changes, and exchange information. “Portal traffic is very fluid,” explains the system analyst. “The number of servers can increase or contract sometimes daily; five to 20 instances come online very week. The public cloud is the perfect vehicle to handle such fluctuations in bandwidth requirements.” For this multiple-agency project, the workloads that run in the public cloud are generated by:
■    SQL and Oracle databases
■    Imaging software, since a huge volume of documents need to be stored digitally for years
■    Agency- or contract-specific applications Small Team Able to Manage Security Across Hybrid Environment For this project, 95% of the security policies for the endpoints within the AWS public cloud are the same as for the company’s physical endpoints, but 5% are unique to the project.“We run a base set of policies for every project, to meet ISO requirements and so on, but with McAfee ePO software, we can easily add or customize policies to meet the security needs of each specific contract and project,”notes the system analyst. Thanks to the intuitive McAfee ePO management console, the company’s information security team of five, spread across three locations, can effectively and efficiently manage a host of McAfee solutions and even some non-McAfee solutions, across a widely dispersed physical and virtual infrastructure that includes private and public cloud. “As a small but dispersed team, we must have tools that work well together and enable us  to work efficiently with one another,” says the system analyst.“McAfee ePO software is basically our eyes and ears across the entire environment. We use it for day-to- day management as well as to remediate threats quickly in conjunction with our McAfee SIEM.” Custom Reports and Automated Responses Speed Compliance and Resolution Using McAfee ePO software, the system analyst and his colleagues have also created customized reports and automated responses as an added cloud defense measure. “To us, whether the endpoint is in the public cloud or on premises, it doesn’t matter,” he says. “We use McAfee ePO software the same way, to manage as well as accelerate time to compliance and resolution.” For example, in McAfee ePO software, he created an agent access report, which runs frequently. The report details which endpoint agents are not reporting back on a regular basis. If an agent doesn’t respond within a set number of minutes—the number is set in the project contract—then the information security team will automatically be notified to investigate. The team also receives automatic notifications if file integrity monitoring queries discover that certain thresholds are reached, such as a user accessing an executable file a certain number of times within a certain number of minutes. “Full Speed Ahead” for AWS Expansion The government contractor has built a hardy, multilayered defense with a McAfee integrated security infrastructure backbone that protects its widely dispersed, hybrid environment and numerous, global government customers. With the addition of McAfee Cloud Workload Security, they have extended that defense and laid the foundation for securely leveraging the public cloud even more in the future, to the benefit of both the company and its customers.
“Now that we can extend robust security to the public cloud, it’s not a question of if we’ll put more projects in AWS, but how many,”says the system analyst.“It’s full speed ahead.”

Integrating McAfee® Advanced Threat Defense and the Bro open-source network security platform widens the scope of threat detection to include unmanaged devices Multinational Software Company

• Large global software company
• Industry: Technology
• Environment: Fluid environment with up to 150,000 endpoints at any given time, many of them virtual, across 20 countries

Challenges

• Protect against zero-day threats across extended global enterprise
• Shrink detection to remediation gap

McAfee solution

• McAfee® Advanced Threat Defense
• McAfee® Complete Endpoint Threat Protection
• McAfee® ePolicy Orchestrator®
• McAfee® Threat Intelligence Exchange

Results

• Accelerates time to protection, thanks to automation
• Augments threat reputation information shared across
• McAfee ePO softwaremanaged devices with information gleaned from incidents involving unmanaged devices
• Facilitates endpoint incident forensics and accelerates response
• Saves security operations time and hassle

Automated submission of threat information to McAfee Advanced Threat Defense and automated sharing of that information across the enterprise improves protection while saving security operations time and hassle. This large global software company with more than 20,000 employees in 20 countries has implemented an IT infrastructure that is highly virtual and fluid. Systems come and go daily on the company’s network. For instance, in a recent week, 45,000 systems, including virtual machines, connected to the corporate network. However, during peak periods, up to 150,000 endpoints can be connected. For the company’s senior manager of security engineering, who oversees the team responsible for deployment of all security tools across the global enterprise, this environment poses distinct challenges. Challenge: Close Gaps to Block Zero-Day Attacks Although the company employs the McAfee Complete Endpoint Threat Protection suite on all its high-risk physical and virtual endpoints, it also has many virtual endpoints connecting to its network that do not have a McAfee agent installed and are therefore not updated with the latest threat protection via the McAfee ePolicy Orchestrator (McAfee® ePO™) management console. The company’s more important virtual machines host a McAfee agent but many “low-risk” systems do not. Until recently, if one of these unmanaged endpoints downloaded a malicious file, the McAfee ePO softwaremanaged endpoints would be at risk because they had no way of knowing of the existence of that threat within the environment. “Zero-day threats are our biggest concern,” remarks the senior manager of security engineering. “If any of our endpoints—managed or unmanaged—downloads a zero-day threat, we want our whole environment to know about it, and we want to be able to react appropriately as fast as possible.” In addition, if a managed endpoint became infected, security analysts would receive an alert, but, because of the fluidity of systems coming on and off the network, by the time an analyst has logged in and has attempted to find the suspicious payload, the system could easily have moved offline, essentially removing the information needed to understand what had transpired. As a result, security operations center (SOC) engineers found that they had to spend extra time tracking down infected systems and remediating them. Hunting and Blocking Zero-Day Threats with McAfee Advanced Threat Defense Along with McAfee Complete Endpoint Threat Protection, the company had implemented the Data Exchange Layer (DXL) communication fabric and McAfee Threat Intelligence Exchange. DXL connects and optimizes security actions across multiple vendor products, as well as internally developed and open source solutions, and McAfee Threat Intelligence Exchange leverages DXL to bi-directionally share threat information across all DXL-connected systems. To this automated threat reputation-sharing framework, the company added McAfee Advanced Threat Defense for “zero-day hunting,” as the senior manager of security engineering describes the appliance’s main role.  “If an unknown or suspicious file comes across one ofour endpoints protected by McAfee Endpoint Security, the file is automatically sent to McAfee Advanced ThreatDefense for sophisticated static and dynamic behavioralanalysis,” explains the senior manager of securityengineering. “If McAfee Advanced Threat Defensedeems the file to be malicious, its reputation is thenautomatically broadcast via McAfee Threat IntelligenceExchange to all the endpoints connected to DXL. Thisautomatic distribution of threat reputation informationhelps us block zero-day threats before they can harmour environment.” Enhancing Intrusion Detection with Bro But what about threats entering the environment through the company’s many unmanaged endpoints? To extend detection to these systems, the company turned to the open-source Bro network security monitoring platform. Bro ingests the company’s network traffic off a span or inline tap and converts the traffic data into logs and metadata in binary format. In a typical week, Bro submits approximately 6,000 files to McAfee Advanced Threat Defense for analysis. Of those, approximately 10% to 20% end up in the McAfee Threat Intelligence Exchange threat reputation database and are subsequently shared throughout the enterprise. “Bro gives us the ability to retain network traffic in a searchable format, which is extremely useful,” the senior manager of security engineering explains. “For instance, using Bro, we can search for source or distributed IP so we can easily conduct lightweight investigations— discover who or what connected to a specific IP address, what the payload looks like, determine the packet size, and so on.” The information captured by Bro supplements the threat information delivered via the McAfee Global Threat Intelligence cloud and disseminated via McAfee Threat Intelligence Exchange. With the Bro script and advice provided by McAfee (now available as a deployment kit), the senior manager of security engineering’s team integrated Bro with McAfee Advanced Threat Defense so that the Bro traffic data is automatically submitted to McAfee Advanced Threat Defense, just as suspicious files from McAfee Endpoint Security are automatically submitted through McAfee Threat Intelligence Exchange. Since the team was already very familiar with Bro, the integration was straightforward. Automatic Immunization Against Threats that Hit Unmanaged Endpoints “If one of our unmanaged endpoints downloads a malicious file, Bro will capture that event among the network traffic and submit it to McAfee AdvancedThreat Defense for analysis,” notes the senior managerof security engineering. “If McAfee Advanced ThreatDefense determines the file is malicious, then thatmalicious reputation will be shared automatically withevery McAfee ePO software-managed system in ourentire enterprise—in other words, with all the systemswe care about. Put another way, if one of our unmanagedvirtual machines downloads a malicious file, all of ourmanaged devices automatically receive an immune shot.” Facilitating and Accelerating Incident Response With the McAfee Advanced Threat Defense/Bro integration and threat reputation information automatically disseminated across endpoints via McAfee Threat Intelligence Exchange, inoculation of endpoints happens much faster than it did before. Consequently, there is a much greater likelihood that a system will “receive the immune shot” before it goes offline. In addition, because the actual event and surrounding intelligence is captured by Bro, even if the system goes offline, McAfee Advanced Threat Defense, as well as security analysts, have a great deal more information to help determine appropriate action, and, if necessary, to remediate more quickly. “With the McAfee automated threat framework and supporting intelligence from the Bro integration, plus automated remediation that we have also set up, our SOC very rarely needs to pay attention to endpoint incidents,” points out the senior manager of security engineering. “The Bro integration and all that automation save a ton of time.” To fortify its defenses further, the company continues to build upon its DXL-based integrated security framework. For instance, the company is currently in the process of adding McAfee DLP Monitor to gather, track, and report on data in motion across its entire network and augment its McAfee DLP Endpoint host-based data protection. “The more we can integrate our systems and automate responses, the safer we will be,” says the senior managerof security engineering.

With McAfee® Endpoint Security, McAfee Advanced Threat Defense, and McAfee Threat Intelligence Exchange, this CIO can focus on his main job, using technology tokeep his company thriving and to increase value for his company’s customers, notinformation security.  Challenges Simplify security management for small information security team Minimize impact of security on business end users Keep organization secure, avoid unwanted appearances in the boardroom McAfee Solution

• McAfee® Advanced ThreatDefense
• McAfee Complete Endpoint Threat Protection
• McAfee Endpoint Security
• McAfee ePolicy Orchestrator
• McAfee Threat Intelligence Exchange

Results

• Elimination of ransomware
• Superior endpoint protection experience for both end users and administrators
• Ability to focus on business rather than security issues
• Trusted partnership with company focused solely on security

Harry Folloder loves his job as Chief Information Officer of Waypoint, the premier sales and marketing agency for foodservice (as well as non-foods channels) in North America. As CIO, he oversees the use of technology within the company and across its 1,500 endpoints and three data centers. “It’s fun,” he says. “I get to spend a lot of my time innovating and looking for ways to use technology to increase the value we provide our customers.” No News is Good News Folloder’s job was a lot less fun and his phone a lot less quiet a few years ago. “So much of my security staff’s time was spent dealing with false positives and other program problems; they would end up calling me and griping about the problems,” recalls Folloder, who is also CIO of Marlin Networks, the leading marketing agency in the food service industry. “Sometimes the security issues would even take salespeople out of the field for a day or two while waiting for the issue to be resolved. Ultimately, I decided we needed a security partner focused solely on security, with products that do what they’re supposed to do, so I don’t have to hear about them and, more importantly, so our end users can keep focusing on doing their part to serve our customers and grow our business.” Folloder says his top priority as CIO is to be an ambassador to clients and customers and to keep the business moving forward. “Keeping security running is not my job,” he says. “When security is running smoothly and my phone is quiet, with no unwanted calls from my security team or my Board, then I can focus on my real job.” Result of Migrating to McAfee Endpoint Security: Better User Experience and Reduced TCO Folloder found in McAfee the security partner he was looking for. After replacing Waypoint’s previous endpoint protection software with McAfee Complete Endpoint Protection Enterprise (now called McAfee Complete Endpoint Threat Protection), phone calls from his staff decreased significantly. When Folloder and his staff heard that McAfee was introducing a new, more intelligent, more collaborative endpoint protection framework, McAfee Endpoint Security, they couldn’t wait to take advantage of it. After running McAfee Endpoint Security version 10.2 briefly in a test environment, they used the McAfee ePolicy Orchestrator® (McAfee ePO™) central console to push it out across all of Waypoint’s approximately 1,500 nodes. The migration of the virus scanning engine, McAfee VirusScan® Enterprise, and McAfee SiteAdvisor® software from the McAfee Complete Endpoint Threat Protection to McAfee Endpoint Security took place within a two-and-a-half-week period that also included deployment of McAfee Threat Intelligence Exchange across all endpoints and McAfee Advanced Threat Defense for sandbox analysis. “Migrating to McAfee Endpoint Security was one of the easiest platform migrations ever,” notes Folloder. “It went off without a hitch. The only calls received were from a handful of users who had shut down or rebooted in the middle of the upgrade process. Folloder and his staff have been extremely pleased with the results. “McAfee Endpoint Security is a much better experience for our administrative staff, providing better protection with less management time,” says Folloder. “It allows us to better serve our business with higher quality levels, lower total cost of ownership, and lower cost of administration. It also allows our business users to focus on their jobs rather than issues caused by security software.” No Ransomware. Period. Folloder was most excited to integrate McAfee Endpoint Security with McAfee Advanced Threat Defense via McAfee Threat Intelligence Exchange, for even greater ability to combat advanced threats and deliver actionable threat forensics. Leveraging the McAfee Data Exchange Layer (DXL), McAfee Threat Intelligence Exchange combines multiple internal and external threat information sources and instantly shares this data along the DXL backbone that extends to all of the company’s nearly 1,500 nodes. Integration of McAfee Endpoint Security with Threat Intelligence Exchange enables information generated by McAfee Advanced Threat Defense to be shared immediately with all endpoints. “McAfee Threat Intelligence Exchange is information sharing at its best; you’re aggregating everything that McAfee and all of its customers are seeing in a way that helps crowdsource the good info,” explains Folloder. “It gives us comprehensive, near real-time threat intelligence and shares it with all our machines to make them safer.” As for McAfee Advanced Threat Defense, Folloder says: “One of the initial things that caught my eye was the inspection methodology and in-depth analysis that Advanced Threat Defense does, that I just didn’t see elsewhere. Its simple packet inspection, which is what a lot of malware targets, and in-depth analysis of disassembled raw code drew me in immediately. Then when I found out what else it did, I became a true believer. Best of all, it fulfills its promise to detect zeroday, zero-hour attacks, and does so in a very elegant way with minimal end-user impact.” “Since implementing McAfee Endpoint Security, Threat Intelligence Exchange, and Advanced Threat Defense, we haven’t had a single case of ransomware,” says Folloder. “Period.” McAfee Advanced Threat Defense also catches many undesirable files that try to install on users’ browsers, such as adware, the Mindspark toolbar, fake utilities like Optimizer Pro and PC Accelerator, and plugins for music players, coupons, and online games. Experience Improved for Both Business Users and Security Administrators Waypoint’s legacy endpoint protection—McAfee VirusScan Enterprise software—although many times better than the company’s previous antivirus solution, still required some heavy processor usage at times. With the upgrade to McAfee Endpoint Security, however, the impact of malware scanning on CPU utilization has diminished significantly.  “Our end users have a much better experience,” says Folloder. “Whether or not their personal computer has experienced a significant change in processor usage, all of our users perceive less interference and faster computing. Since the rollout of McAfee Endpoint Security, we haven’t heard a single complaint about corporate virus scans.” The user experience for Waypoint’s two information security administrators has also improved with the migration to McAfee Endpoint Security. “I don’t have to interact with [Endpoint Security] much, which is a good  thing,” says Folloder, “but my techs say that it has a much nicer, more modern interface than before.” Quiet and Peace of Mind “Worth Every Penny” “At my level, the measure of success for a product is that I haven’t had to hear about it or worry about it,” says Folloder. “I haven’t had to mess with McAfee Endpoint Security. I haven’t had to hear from anyone in the C-suite or their direct reports. It is doing exactly what we paid for it to do and I love it.” Furthermore, adds Folloder, since the migration to McAfee Endpoint Security, endpoint protection has not interrupted a single associate or sales person’s work. “The less interruptions of business and service to our customers, the better,” he states. “That’s really my overarching goal. That’s why I invest in products like McAfee Endpoint Security. It’s worth every penny.” A True Security Partner But it’s not just the quality of products that count. “I look for partners, not vendors,’ says Folloder. “At the end of the day we’re a service company. Partnering with the best allows us to focus on our core competency.” “I know I sound like an ad for McAfee, but I really do love that I can sleep at night, knowing that Waypoint’s IT infrastructure is protected by a company that is focused on protecting my environment and not distracted by backup or storage or whatnot,” continues Folloder. “Ask yourself, ‘Is my security vendor focused specifically on securing my environment? Does it have leading researchers and state-of-the-art resources to protect my infrastructure and users, and to keep innovating and evolving to face new threats?’ Take a hard look. My experience with McAfee has been everything a partnership should be and more.”

Description is not ready yet

Description is not ready yet

HollyFrontier is a Fortune 500 independent refiner and distributor of petroleum products. The company operates six refineries—five in the middle of the US and one in Ontario, Canada. The company employs 3,500 people across 43 sites in the US, 16 in Canada, and a handful of locations in China and the United Kingdom.
Search for Better Endpoint Protection Leads to Revamped Security Architecture As part of an endpoint security review, HollyFrontier invited six leading vendors to make presentations in competition for the business. McAfee stood out from the other vendors with its integrated security strategy and attainable vision of a threat defense lifecycle that learns and adapts to meet changing requirements. “We agreed wholeheartedly with the McAfee® approach,” says Cybersecurity Engineer Phillip Fort, the main person responsible for HollyFrontier’s day-to-day security posture. “With the integrated McAfee ecosystem, our limited security team can automate a lot of security tasks. We can essentially do a lot more to protect our company a lot faster, without adding staff.” In addition to McAfee endpoint protection and its bundled McAfee ePolicy Orchestrator (McAfee ePO) central console, in just a few weeks, HollyFrontier deployed:
■    McAfee Network Security Platform intrusion prevention system (IPS) appliances.
■    McAfee Data Exchange Layer, the open-source fabric that connects security components to automate integration and real-time data exchange.
■    McAfee Threat Intelligence Exchange, which aggregates threat intelligence from local and global sources and shares file reputation information across McAfee Data Exchange Layer-connected systems.
■    McAfee Enterprise Security Manager and other components of the McAfee SIEM solution set.
■    McAfee Advanced Threat Defense sandboxing appliance. Within a year, the company also began deploying McAfee Endpoint Threat Defense and Response and McAfee Web Gateway. Infection Rate and Ransomware Reduced Dramatically HollyFrontier initially deployed the McAfee Complete Endpoint Threat Protection suite. However, because of “all the ransomware going around,” HollyFrontier was anxious to install McAfee Endpoint Security and its Dynamic Application Containment (DAC) functionality. When DAC encounters a file that does not have a trusted reputation or is unknown, it immediately quarantines the file before it can infect “patient zero.” Consequently, as soon as McAfee Endpoint Security became available, the company migrated the McAfee VirusScan® Enterprise portion of its endpoint protection suite to the McAfee Endpoint Security Threat Prevention module, first rolling out version 10.1, then upgrading to version 10.2, and upgrading again to version 10.5.
Although DAC initially blocked a few legacy applications that are still used, Fort was able to quickly create exclusions for those applications. “The McAfee Endpoint Security graphical user interface is very easy to use,” he notes.“Once I created the first couple exclusions, the rest were easy.” It didn’t take long for the biggest impact of the new endpoint protection framework to became evident. “After implementing McAfee Endpoint Security and DAC, our malware infection rate plummeted,” states Fort. “We used to have ransomware attacks each month, but we have had none since migrating to McAfee Endpoint Security and integrating it with McAfee Threat Intelligence Exchange and McAfee Advanced Threat Defense … Truthfully, I don’t have to deal with McAfee Endpoint Security very much—and that’s a good thing.” Results of Sandbox Analysis Automatically Shared Throughout Enterprise
As Fort contemplated the benefits of an integrated security platform prior to its implementation, the integration he was most excited about was that of the endpoint and other security components with the McAfee Advanced Threat Defense.
“McAfee Advanced Threat Defense does as much or more than other sandboxes, but its integration with other McAfee solutions is what makes it so incredibly powerful,” says Fort. “It immediately detects and contains a potentially malicious file on the endpoint, IPS, or gateway.
First it sends the file automatically to McAfee Advanced Threat Defense for analysis, and, if found malicious, the file is then automatically removed across the entire enterprise. That is truly transformative for our small security team,” states Fort. “It augments our own abilities and saves us a lot of time.” Every day a security analyst checks McAfee Advanced Threat Defense to review the list of files that the appliance has convicted as malicious. “Once an administrative assistant clicked on a phishing email,” explains Fort. “The IPS, McAfee Network Security Platform, blocked the suspicious file and sent it to McAfee Advanced Threat Defense, which determined that it was bad. The file appeared in the day’s list of convicted files, and we confirmed that it was indeed blocked and automatically entered in the McAfee Threat Intelligence Exchange reputation database shared throughout the enterprise.”
Periodically, the HollyFrontier security team runs assessments in which sample malware is put on a machine. “We then watch to make sure the malware shows up in McAfee Advanced Threat Defense and is removed from the host machine and blacklisted throughout the enterprise,” clarifies Fort. “It works every time—just as it’s supposed to.” Increasing Visibility and Facilitating Reporting with McAfee SIEM The desire for better visibility across the enterprise drove HollyFrontier to replace its aging SIEM with the McAfee SIEM technology. According to Fort, McAfee SIEM technology provides a much more complete security picture and widespread visibility across the network, which helps in countless ways. To cite just one example, a considerable number of users were becoming locked out as they tried to reset their passwords because they had failed to log off other machines. A security analyst simply entered the user ID in the McAfee SIEM system, and immediately could see exactly which machines a user was logged into, whether or not he was locked out, and whether he should have access—and then could reset passwords as necessary. “In that case and many more, McAfee Enterprise Security Manager technology saves us a lot of investigative time,” says Fort. The HollyFrontier security team also uses many out-of- the-box rules and alerts, as well as custom ones within the McAfee SIEM solution. “Even if we haven’t developed a custom rule, if I have just a little information on a security event, it is easy to drill down and do a search based on single or multiple variables to find as much additional information as I need,” explains Fort. The McAfee Enterprise Security Manager solution also makes reporting easier. For example, to produce a quarterly security review to upper management, Fort simply runs out-of-the-box executive reports created by the McAfee SIEM solution and McAfee Advanced Threat Defense from within McAfee ePO software.
Rapid Searching Saves Time, Eliminates Vulnerabilities Faster
According to Fort, before learning about the McAfee integrated security platform, he had “fallen in love” with an endpoint detection and response (EDR) product from another vendor. “When we looked at McAfee Endpoint Threat Defense and Response, however, we realized it did everything that other solution did,” he recalls. “It gives us all the information we ever wanted to know— really, really fast.” With the McAfee EDR software, the HollyFrontier security team can eradicate vulnerabilities much faster. If Fort learns of a vulnerability in a specific version of an application—for instance, in Microsoft Office 2013—he can use the McAfee Active Response search functionality to quickly and easily find out exactly how many desktops have that version or create a list of all endpoints with that version. It took less than a minute for one of Fort’s colleagues to find all versions of Adobe Acrobat in the enterprise recently and just a few more minutes to determine which endpoints required updating. After pushing out the update, he clicked to rerun the search to confirm that all the updates were successful.
“The rapid searching we can do using McAfee Active Response saves us a tremendous amount of time,” says Fort. “We used to manually maintain inventory spreadsheets of all the various applications and systems. Now we can run real-time reports in seconds, and everyone is confident they are correct.” Adding Hybrid Web Protection At a McAfee user conference, while Fort was singing the praises of McAfee Network Security Platform and McAfee Advanced Threat Defense to other attendees.
Many of the participants were raving about McAfee Web Gateway, claiming it was their favorite McAfee product, prompting Fort to investigate. He quickly became convinced that McAfee Web Gateway was worth the investment, even though the company had an adequate web gateway solution. In addition to being able to share threat information in near real time with the other McAfee Data Exchange Layer-connected security solutions, McAfee Web Gateway offers more granular control and the ability to deploy a hybrid environment managed from the same console.
As a result, HollyFrontier is in the process of deploying its first McAfee Web Gateway appliance and McAfee Web Gateway Cloud Service. HollyFrontier employees working from home or on the road will be protected by the same corporate web security policies as users at corporate locations. In addition, any malware detected by McAfee Web Gateway is sent immediately to McAfee Advanced Threat Defense, and its information is shared throughout the enterprise. Integration and Increased Protection Ease Security Administration “With the McAfee integrated security infrastructure and McAfee ePO software, I can manage just about everything through one pane of glass,” says Fort. “That alone makes administration so much easier, but so does increased protection. If there is an infection somewhere else in the world, thanks to McAfee Threat Intelligence Exchange, my network knows about it and is protected before the infection even reaches us. If, on the other hand, the malware is detected within our environment, it is immediately sent to McAfee Advanced Threat Defense for analysis, and the rest of the environment is automatically informed. We have reduced operational overhead dramatically while improving our security posture.”
Fort has not only been impressed with McAfee products and their integration with one another, but also with McAfee personnel. “Any time I need anything, I just call or email my McAfee Security Engineer, and he responds right away,” he notes. “McAfee Platinum Support is also extremely responsive. I can usually get the help I need within a couple of minutes. We learned early on that McAfee is a strategic security partner as well as a dependable one.”

Ariel Picans, technology risk manager at Banco Delta, is responsible for overseeing the security posture of 400 endpoints and safeguarding the assets that reside both within the perimeter of the organization and in the cloud, ensuring that sensitive financial information, databases, and documents are secured against known and emerging threats. Once a year, Picans and his team conduct security checks and assessments of the infrastructure, creating vulnerability tests using various methods to make sure that alerts and filters are functioning properly. Over the years, Picans has been building out Banco Delta’s security infrastructure with solutions that, in his words, “add value and protect the bank’s environment from future attacks.” As a long-time McAfee customer,
Banco Delta was looking to upgrade to deepen and broaden protections and further simplify and consolidate security management. Additionally, Picans wanted to make sure that the bank was implementing the security controls required by compliance regulations and could provide detailed reports at audit time. McAfee Solutions Expand Security Options at Banco Delta Picans has always appreciated the advantages of the single-vendor, integrated approach offered by McAfee. Positive reviews from industry analysts like Gartner and Forrester, along with streamlined management, support, and communications prompted him to continue down the same path and explore the latest McAfee innovations, particularly McAfee® Endpoint Security 10.5 and McAfee ePO 5.9.1 software. Several years ago, Picans and his team relied on McAfee® VirusScan® Enterprise for strong antivirus and anti- malware. When he learned about McAfee Endpoint Security, Picans was impressed with the solution’s multilayered protection and made a decision to upgrade as a way of protecting Banco Delta against rapidly evolving threats. The solution provides not only antivirus but also encryption and integration with data loss prevention (DLP). McAfee Endpoint Security in collaboration with McAfee ePO software, McAfee® DLP Endpoint, the McAfee Network DLP solution, and McAfee® Network Security Platform enables him to create and enforce strict data access policies for devices both within and outside the four walls of the bank. The McAfee® Web Gateway appliance is also part of the ecosystem, using a host of techniques to analyze all web traffic and offering protection against malware and malicious code hidden through encryption.
To round out Banco Delta’s security infrastructure, Picans added McAfee® Enterprise Security Manager, a security and events management (SIEM) solution that integrates with all of the bank’s solutions. It uses advanced analytics to give Picans and his team context and to enable them to prioritize threats and assess risks. McAfee Enterprise Security Manager also centralizes and automates compliance monitoring and reporting, with pre-built dashboards, audit trails, and reports for more than 240 global regulations. “We migrated to McAfee Endpoint Security because it has opened up a wide gamut of options, all managed by a single console and a single agent. We’ve taken maximum advantage of this tool and have experienced very positive results. For all these reasons, we trust and count on McAfee security technology,” says Picans. A Collaborative Ecosystem with McAfee ePO at the Helm Since the upgrades, Picans has observed a noticeable reduction in both infections and in potentially compromising user behavior. The integration of McAfee® Threat Intelligence Exchange extends another layer of protection and speeds detection and response across the bank’s entire environment. McAfee Threat Intelligence Exchange shares threat intelligence from third-party sources and locally collected intelligence with other McAfee and third-party security solutions via the Data Exchange Layer (DXL) communications fabric. As Picans points out, all of the McAfee solutions in the bank’s integrated ecosystem can act immediately on this intelligence and swiftly block or quarantine threats. Banco Delta made a decision to add McAfee Threat Intelligence to its arsenal when Picans and his team detected an increase in usage of unauthorized applications. “Because of this, we needed a tool that provides information on whitelisted and a blacklisted applications. McAfee Threat Intelligence is the perfect solution because it provides us with visibility across the whole organization,” he says. Now Picans can customize data for his organization— including blacklists and whitelists of applications.
Reports generated by the McAfee ePO console provide an overview of executed applications—both authorized and unauthorized. This allows him to see whether somebody has been engaged in malicious or unauthorized activities. Picans and his team simply configure McAfee Threat Intelligence, let it run, and check reports on a daily basis. McAfee Solutions Keep Advanced Threats in Check and Prevent Disruption As the management hub for Banco Delta’s McAfee solutions, McAfee ePO software is integral to security operations. Picans relies on McAfee ePO software to ensure that every endpoint has antivirus and encryption, updated .DATs, and more. Picans and his team can also pull reports from the McAfee ePO dashboard with details like analysis and classification of malware by type, blocked malware, and devices that are most vulnerable to attack. Picans consolidates this information and provides the bank’s executive committee with a comprehensive view of
Banco Delta’s risk profile every month. He also finds this data useful for trend analysis. “The main benefit of this collaborative approach has been the reduction of the advanced malware and ransomware attacks that have been in circulation recently. Thanks to McAfee ePO software and our other McAfee solutions, we’ve been able to carry on without disruption, while other organizations have suffered from data breaches, putting their day-to-day operations at risk,” explains Picans. To protect against today’s continually morphing threats, Picans deployed McAfee® Advanced Threat Defense.
McAfee Advanced Threat Defense combines multiple powerful technologies—in-depth static code analysis, dynamic analysis through sandboxing, and machine learning—to help the bank accelerate detection of zero-day malware, evasive threats, and ransomware. In the first month of deployment at Banco Delta, McAfee Advanced Threat Defense proved its value by intercepting Locky, a prolific and persistent strain of ransomware that continues to reappear with new variants. Picans also uses McAfee Advanced Threat Defense to support security investigations. He points out that it has detected several malicious archives that were missed by solutions from other vendors. Picans submits these malware samples to McAfee Advanced Threat Defense to derive insights on indicators of compromise, which help him gain a better understanding of highly camouflaged threats. Since deploying these McAfee solutions, Picans has seen a significant reduction in attacks and data loss. Additionally, the integrated and connected McAfee ecosystem, with its single-console management through McAfee ePO software, has resulted in notable operational efficiencies as compared to a multivendor environment. “When you have a collection of unintegrated products with multiple management consoles, you need more people, and they need additional, highly specific training. McAfee has reduced the need for hiring additional personnel,” he affirms. “Plus, with its modular, centrally managed system, McAfee opens up a world of possibilities.” Stepping Up Security Across On-Premises, Virtualized, and Cloud Environments McAfee® Cloud Workload Security (CWS) will help increase Banco Delta’s visibility to elastic workloads in the public cloud and AWS (Amazon Web Service)/ VMware environments and will provide an integrated defense against advanced attacks. CWS with AWS is an example of how we can forge forward fearlessly in the cloud. McAfee® MOVE AntiVirus currently offers optimized security for virtualized desktops and servers. “I know that, with McAfee, I can count on having the same level of security in the cloud and in virtualized environments as we have on premises,” he notes. The bank currently has plans in the works to provide cloud-based services and applications for both external clients and internal stakeholders. When Banco Delta fully launches these cloud services, Picans and his team will be responsible for making sure all communications and data are encrypted and secure. For example, it will be really important to reassure the sales department that their information won’t be exposed and will be monitored regularly and that the bank’s databases won’t be compromised. “McAfee protects everything that’s online—not just within the network perimeter. The company’s advancements in cloud security and other innovations speak for themselves. It shows that McAfee is truly concerned about protecting its customers and that it strives to stay current with new technology trends and the evolving threat landscape,” summarizes Picans.